On October 25, 2024, the National Center for Personal Data Protection (NCPDP) organized a training course for the representatives of the “North” Territorial General Directorate of the National Anti-Corruption Center, at their request.

The purpose of the training course, entitled “The legal regime of personal data protection”, was to increase the NAC employees’ awareness on the principles of personal data protection, in order to know and assimilate the best practices in the field, as well as to ensure the correct application of the legal provisions in the activity they perform.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; principles and legal grounds for processing personal data; requirements for the protection of personal data in the exercise of official duties; ensuring the security and confidentiality of personal data processed, etc.

The training course proved to be an interactive one, the participants asking multiple questions arising from their work, to which they received documented answers with practical examples from the trainers. At the same time, the topics related to the correct procedure for accessing personal data through the state information systems and the records kept by the NAC of such accesses, as well as access to information of public interest through the legislation on the protection of personal data, were of great interest to the course participants.

During the event about 20 representatives of the Territorial General Directorate “North” of the National Anticorruption Center were trained.

On 19 September 2024, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the employees of Briceni Border Police Sector of North Regional Directorate, in the context of the elaboration / implementation by the IGPF of the “Concept on the functional and decision-making autonomy of the Border Police patrol in the activity of state border surveillance“.

The aim of the training course was to increase the awareness of the employees of Briceni Border Police Sector of the North Regional Directorate, who supervise the border in order to combat illegal migration, trafficking in human beings and cross-border crime, on the principles of personal data protection and on ensuring the correct application of the legal provisions in the field in the work they perform.

• During the event topics of importance were discussed such as: 

• Definition of general notions related to the field of personal data protection; 

• Principles and legal grounds for processing personal data; 

• The rights of personal data subjects; 

• Processing of special categories of personal data; 

• Requirements for the protection of personal data in the performance of official duties; 

• Ensuring the security and confidentiality of personal data processed; 

• Data Protection Officer (DPO) designation issues;

• Data Protection Impact Assessment (DPIA) issues, etc.

The training course proved to be very useful, and the aspects related to the correct procedure of accessing personal data through the state information systems in order to identify persons who do not have identity documents in the border area, as well as the consequences of a non-compliant/illegal processing of personal data, were of great interest to the participants.

During the event about 40 representatives of Briceni Border Police Sector of the North Regional Directorate were trained.

The training courses are part of the training plan within the IGPF for the year 2024, approved and signed by the heads of NCPDP and IGPF on February 21 this year.

On 24 September 2024, the National Centre for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the employees of the Sculeni Border Police Sector of the Western Regional Directorate, in the context of the elaboration / implementation by the IGPF of the “Concept on the functional and decision-making autonomy of the Border Police patrol in the activity of state border surveillance”.

The purpose of the training course was to increase the awareness of the employees of the Sculeni Border Police Sector of the West Regional Directorate, who supervise the border in order to combat illegal migration, trafficking in human beings and cross-border crime, on the principles of personal data protection and on ensuring the correct application of the legal provisions in the field in the work they perform.

During the event, important topics were discussed, such as: the definition of general concepts related to the field of personal data protection; principles and legal grounds for processing personal data; the rights of personal data subjects; the processing of special categories of personal data; the requirements for the protection of personal data in the exercise of official duties; ensuring the security and confidentiality of personal data processed; issues related to the appointment of the Data Protection Officer (DPO); issues related to the Data Protection Impact Assessment (DPIA), etc.

The training course proved to be interactive and useful, as the participants asked multiple questions, resulting from their work, to which they received documented answers with practical examples from the trainers. At the same time, issues related to the correct procedure for accessing personal data through state information systems, the correct procedure for identifying persons who do not have identity documents, as well as the examination of requests for disclosure of personal data, were of great interest to the course participants.

About 50 representatives of the Sculeni Border Police Sector of the Western Regional Directorate were trained during the event.

The training course is part of the training plan within the IGPF for the year 2024, approved and signed by the heads of the NCPDP and IGPF on February 21.

The National Center for the Protection of Personal Data (NCPDP), for information and enforcement purposes, communicates about the administrative fine of 30.5 million euro imposed by the Dutch Supervisory Authority (SA) on Clearview for violation of Article 6 Lawfulness of processing, Article 9 Processing of special categories of personal data, Article 12 Transparent  information, communication and modalities for the exercise of the rights of the data subject, Article 14 Information to be provided where personal data have not been obtained from the data subject, Article 15 Right to access by the data subject, Article 27 Representatives of controllers not established in the Union and Article 84 Penalties.

Clearview is an American company that offers facial recognition services. Customers of Clearview can provide camera images to find out the identity of people shown in the images. For this purpose, Clearview has a database of more than 30 billion photos of people. The company automatically collects these photos from the internet and then converts them into a unique biometric code for each face without the person’s knowledge or consent.

As a result of its investigations, the Dutch SA finds that for the purpose of their ‘Clearview for law-enforcement and public defenders’ service, Clearview processes, without a legal basis to do so, personal data of data subjects who are within the territory of the Netherlands. In doing so, Clearview violates Article 5(1), opening words and subsection (a) of the GDPR, read in conjunction with Article 6(1) GDPR. Clearview also infringes Article 9(1) of the GDPR by processing a special category of personal data (biometric data) of data subjects located in the Netherlands. 

The Dutch SA has determined that Clearview does not adequately inform data subjects, acting in this case contrary to Article 12(1) in conjunction with Article 14(1) and (2) and contrary to Article 5(1)(a) of the GDPR. 

Last but not least, violated Article 12(3) GDPR, read in conjunction with Article 15 GDPR by not responding to two access requests by data subjects. And fifth of all, since Clearview does not facilitate data subjects within the territory of the Netherlands in exercising their right of access, they violate Article 12(2) GDPR, read in conjunction with Article 15 GDPR. The fact that Clearview has not designated a representative in the European Union within the meaning of Article 4, paragraph 17 GDPR, although they are obliged to do so pursuant to Article 27(1) GDPR, also constitutes a violation of the GDPR.

In this context, the Dutch SA has imposed on Clearview an administrative fine of €30.5 million and four measures subject to a penalty for non-compliance, which relate to the cessation of the infringements still in progress. If Clearview fails to do so, the company will have to pay non-compliance penalties totaling up to a maximum of €5.1 million in addition to the fine.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

On September 25, 2024, the National Center for the Protection of Personal Data (NCPDP) organized a training course in the field of personal data protection for the employees of Vulcănești Police Inspectorate (PI) of the DP of UTA Găgăuzia.

The purpose of the training course was to increase the degree of perception of  Vulcănești PI employees on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they carry out.

During the event, important topics were discussed, such as:

• Definition of general notions related to the field of personal data protection;

• Rights of personal data subjects;

• Processing of special categories of personal data;

• The legal way of processing personal data in the activity carried out by police bodies;

• The requirements regarding the protection of personal data, in the exercise of service duties;

• Obligations of the police body as a data controller in relation to the data subject;

• Ensuring the security and confidentiality of processed personal data, etc.

The training course proved to be very useful and interactive, the trainers from the NCPDP providing the participants with practical answers to the multiple questions asked by them. At the same time, the aspects related to the correct procedure for accessing personal data through state information systems, such as the examination of requests for disclosure of personal data, showed increased interest for the participants.

About 20 representatives of Vulcănești Police Inspectorate of the DP of UTA Găgăuzia were trained during the event.

The training course is part of the training plan within the GPI subdivisions for 2024, approved and signed by the heads of the NCPDP and GPI on January 26.

On 26 September 2024, the representatives of the National Center for Personal Data Protection organized a training course for the employees of the Psychiatric Clinical Hospital, at their request.   The aim of the course was to strengthen the capacities of medical staff by sensitizing, familiarizing and informing them with the field of personal data protection.

The event addressed topics of importance such as: 

• Defining personal health data; 

• Processing special categories of personal data; 

• Legal grounds for processing personal health data; 

• Patients’ rights; 

• Mandatory secrecy of personal data;

• Disclosure of personal health data; 

• Data minimization and storage limitation; 

• Processing of personal data in the work of healthcare professionals; 

• Obligation to ensure confidentiality and security of data processing; etc.

The training course proved to be a useful one, with participants asking multiple questions to the trainers and receiving documented answers with practical examples. At the same time, the topics related to the processing of personal data in the work of medical staff, the patient’s right to confidentiality of information related to medical secrecy, as well as the disclosure of such data, were of great interest to the participants.

About 60 representatives of the Clinical Psychiatric Hospital were trained during the event.

The National Center for the Protection of Personal Data (NCPDP), for information and enforcement purposes, communicates about the administrative fine of 100 000 euro imposed by the Belgian Data Protection Authority for violation of Article 12 Transparent information, communication and modalities for the exercise of the rights of the data subject and Article 15 Right of access by the data subject of the GDPR.

The complainant, a customer of a telecommunications controller, following a contractual incident, followed a mediation procedure with the controller. The controller admitted his fault, but the complainant nevertheless exercised his right of access to his personal data. He requested, inter alia, to know the identity of the employees who processed his personal data and the purposes of the processing. The request was sent via the controller’s messenger channel with the express request that it be forwarded to the Data Protection Officer (DPO). However, despite the fact that his request has been handled by two employees, it has not been satisfied, nor transferred to the DPO. The complainant subsequently lodged a complaint with the Belgian SA and received a response from the controller 14 months after his request for access to personal data.

Following the investigations, the Belgian DPA considered that the complainant’s request was largely satisfied. At the same time, the controller was found to have breached certain provisions of the GDPR because of the 14-month delay in responding and because the controller failed to forward the complainant’s request to its DPO. However, the penalty, amounting to €100 000, is based solely on the breach of Article 15 of the GDPR. The decision is not final and can be challenged by the parties.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legislative framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

On September 18, 2024, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the employees of the Ceadir-Lunga Police Inspectorate (PI) of the Police Department of Gagauzia ATU.

The aim of the training course was to increase the IP employees’ awareness on the principles of personal data protection and to ensure the correct application of the legal provisions in the work they perform.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; the legal way of processing personal data in the activity carried out by police bodies; the requirements for the protection of personal data in the exercise of their duties; the obligations of the police body as data controller in relation to the data subject; ensuring the security and confidentiality of personal data processed, etc.

The training course proved to be an interactive one, with participants asking multiple questions to which they received answers/explanations from the trainers in the field of personal data protection. At the same time, the legal way of processing personal data in the activity carried out by police bodies, as well as the correct procedure of accessing personal data through the State Information Systems, were of great interest for the participants.

About 45 representatives of the Ceadir-Lunga Police Inspectorate of the Police Department of Gagauzia ATU.

The training course is part of the training plan in the subdivisions of the GPI for the year 2024, approved and signed by the heads of the NCPDP and the GPI on January 26 this year.

The National Center for Personal Data Protection (NCPDP), for information and enforcement purposes, communicates about the administrative fine of 270 000 euro imposed by the Spanish Data Protection Authority on UNIQLO EUROPE, LTD for violation of Article 5 Principles relating to processing of personal data and 32 Security of processing of GDPR.

The complainant in this case, whose employment contract had been terminated, requested access to his payroll information for July 2022. Following the request, the controller sent an e-mail to the complainant that contained an attached PDF document that included his payroll and that of 446 other workers on the staff.

The documentation in the file offers clear indications that UNIQLO violated article 5.1.f) of the GDPR, by not duly guaranteeing the confidentiality and integrity of the personal data of its employees, having been brought to the attention of an unauthorized third party. This duty of confidentiality and integrity must be understood as having the purpose of preventing data leaks that are not consented by the data subject.

Also, the provisions of Article 32(1) of the GDPR have been violated due to the failure to adopt appropriate technical and organizational measures. 

UNIQLO EUROPE, LTD justifies a series of technical and organisational measures to preserve the security and privacy of its information systems. However, these measures were not appropriate to avoid the facts that are the subject of the complaint.  A series of measures adopted subsequently have been provided, such as allowing former employees access to their payrolls for a period of 60 days after the termination of the contract or the review of the payroll process by the human resources department, as well as redesigning the internal protocols of said department. These measures cannot be taken into consideration for the purposes of assessing UNIQLO’s responsibility in the facts.

In this context, the Spanish Data Protection Authority has imposed on UNIQLO EUROPE, LTD a total fine of €450,000 for the infringement of the legal provisions mentioned above, which was reduced to €270,000, based on the provisions of national law, which allow for a reduction of the fine when a controller voluntarily pays the fine and acknowledges responsibility for the violation.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

On 17 September 2024, the National Center for Personal Data Protection organized two training courses in the field of personal data protection for the representatives of the Territorial Social Insurance House (CTAS), North region, at the request of the National Social Insurance House.

The purpose of the training course was to increase the CTAS employees’ awareness of the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

The event discussed important topics such as: 

• definition of general notions related to the field of personal data protection; 

• rights of personal data subjects; 

• processing of special categories of personal data; 

• principles and legal grounds for processing personal data; 

• requirements relating to the protection of personal data in the performance of official duties; 

• ensuring the security and confidentiality of personal data by CTAS employees, etc.

The training courses proved to be interactive and the topics related to the legality of requests for disclosure of personal data to third parties, as well as the correct procedure for accessing personal data through the State Information Systems, were of great interest to the course participants.

During the events, which took place both in person and online, 216 CTAS representatives from Balti, Briceni, Drochia, Dondușeni, Dondușeni, Fălești, Edineț, Florești, Glodeni, Râșcani, Ocnița, Soroca and Sângerei were trained.

The training courses are part of the training plan within the CNAS structural subdivisions for the year 2024, approved and signed by the heads of NCPDP and CNAS on July 08.